Alerting system having a network of stateful transformation nodes

ABSTRACT

An alerting system is provided that includes a network of transformation nodes, and a state change processors. The transformation nodes include input transformation nodes, output transformation nodes, and intermediate nodes that connect the input and output transformation nodes. Each input transformation node can receive an events stream, and is coupled to one of the output transformation nodes by one or more intermediate transformation nodes. Each transformation node (except the input transformation nodes) can receive state updates from those transformation nodes that it subscribes to. Each output transformation node can generate a check result when stored state information for each of the transformation nodes that the output transformation node subscribes to collectively indicates that the check result should be generated. Each output transformation node is coupled to one of the state change processors that can determine whether the check results should trigger an action, and if so, can then perform an action.

CROSS-REFERENCE TO RELATED APPLICATION

This application is a continuation of U.S. application Ser. No.16/298,285, filed Mar. 11, 2019, which is a continuation of U.S.application Ser. No. 15/291,858, filed Oct. 12, 2016 (now U.S. Pat. No.10,275,298 B2), the contents of which are hereby incorporated byreference.

TECHNICAL FIELD

This disclosure relates to alerting systems and methods used to monitorevents streams, and more particularly to alerting systems and methodsthat include a network of transformation nodes used to monitor eventsstreams and implement checks that trigger actions.

BACKGROUND

As a server system of an organization or company grows, at some pointits personnel cannot monitor every single server, and every singlestream of events from every server. As such, software-based alertingsystems are important to help monitor such server systems.

Traditional software-based alerting systems can monitor streams ofevents and notify people when something significant has happened. Intraditional software-based alerting systems, formalized checkexpressions (or “checks”) are periodically executed against various datasources. These data sources are usually time series databases, eventslogs, etc. Based on checks against the various data sources, alerts canbe triggered. For example, in some alerting systems, each check is aquery to one or more of the data sources and a threshold. If a checkresult matches or meets a threshold, then the alerting system generatesan alert, and sends it to a consumer (e.g., an email or SMS address, aself-healing system, or other receiver). Ideally, alerts should begenerated quickly so that a system or personnel can react faster andaddress issues that caused the alert to be generated.

Each new query from an alerting system to verify a check is processedthe same way as any other request to the system: a small subset of datais extracted from a much bigger data set, the extracted data istransformed according to the query, and a result is returned forthreshold checking. Because subset of data involved is many timessmaller than the overall amount of data stored in the events storagesystem it takes some time to extract that data and process it. Moreover,every time the check is performed all the processes of searching,extraction and transformation will be repeated even if nothing haschanged since the last run of that check. This approach is unnecessarilyresource intensive and inefficient.

As the number of event streams and events continues to grow, the numberof stored events streams and number of alerts also continue to increase.This challenges the scalability of the storage and computational layersof the alerting system. As amount of data and checks grows, the storageand computational layers should still run a checks cycle with the samefrequency to keep meeting alerting latency requirements. It means eachcheck must be performed faster.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be understood more fully from the detaileddescription given below and from the accompanying drawings of variousembodiments of the present invention, which, however, should not betaken to limit the present invention to the specific embodiments, butare for explanation and understanding only.

FIG. 1 is a block diagram illustrating a computing environment accordingto an embodiment.

FIG. 2 is a block diagram illustrating an alerting system according toan embodiment.

FIG. 3 is a block diagram illustrating a portion of a streamstransformer of FIG. 2 according to an embodiment.

FIG. 4 is a block diagram illustrating components or modules of aparticular transformation node of FIG. 2 according to an embodiment.

FIG. 5 is a block diagram illustrating a state change processoraccording to an embodiment.

FIG. 6 is a block diagram illustrating an alerting system configurationand management module used to configure and manage an alerting systemaccording to an embodiment.

FIG. 7 is a flow diagram illustrating a system startup method performedby the alerting system configuration module including a sub-process foradding new checks to the alerting system according to an embodiment.

FIG. 8 is a flow diagram illustrating a method performed by an alertingsystem configuration module for applying a new check represented as adirected acyclic graph (DAG) to an existing alerting system according toan embodiment.

FIG. 9 is a flow diagram illustrating a method performed by atransformation nodes discovery service module for discovering existingtransformation nodes or creating new transformation nodes according toan embodiment.

FIG. 10 is a flow diagram illustrating a method for removing an existingcheck from the alerting system according to an embodiment.

FIG. 11 is a flow diagram illustrating a method performed by an alertingsystem configuration module when a new event type arrives according toan embodiment.

FIG. 12 is a flow diagram illustrating a rebalancing method performed bya balancer module according to an embodiment.

FIG. 13 shows a block diagram of an example environment in which anon-demand database service can be used in accordance with someembodiments.

FIG. 14 shows a block diagram of example implementations of elements ofFIG. 13 and example interconnections between these elements according tosome embodiments.

FIG. 15A shows a system diagram of example architectural components ofan on-demand database service environment according to some embodiments.

FIG. 15B shows a system diagram further illustrating examplearchitectural components of an on-demand database service environmentaccording to some embodiments.

FIG. 16 is a block diagram illustrating an exemplary computer system,according to an embodiment.

DETAILED DESCRIPTION

As noted above, traditional alerting systems run checks periodicallyagainst pre-stored data, and every check is computed every time evenwhen nothing has changed since the last run. If something changes, thealerting system will only get to know about the change after some delay,and cannot catch changes earlier than the next time at which that checkis scheduled to run. Another drawback of conventional alerting systemsis that these alerting systems are inefficient because every check isrun or computed at fixed intervals even when nothing has changed everytime without any real motivation for doing so. The same calculations arerepeated even if they were done earlier on the same data but for thedifferent check. Another drawback of traditional alerting systems isthat they run all checks in isolation (i.e., as if all analysis is basedon a single check only). Such systems cannot make complex decisionsbased the results of several checks, or information used to performthose checks.

To address the drawbacks associated with traditional alerting systemsand methodologies, the disclosed embodiments can provide an alertingsystem that is used to implement a number of checks, where each check is“pre-wired” in the system as a combination of transformation nodes andconnections between those transformation nodes. The alerting systemincludes a network of transformation nodes that each store state (orstate information), subscribe to other nodes, and have other nodessubscribed to it. Throughout the description, the terms “state” and“state information” can be used interchangeably depending on thecontext.

In accordance with the disclosed embodiments, a “check” can refer to aformula defined by a path that includes a particular combination oftransformation nodes linked together with at least one of thetransformation nodes being an input transformation node that is coupledto an events stream. Each transformation node has a formula associatedwith it. A formula for a particular transformation node is an expressionthat describes how the output(s) of other transformation node(s), thatthe particular transformation node subscribes to, are to be processedusing a particular transformation rule (or transformation function) forthat particular transformation node. As such, the formula for aparticular transformation node takes into account the formulas andtransformation rules for all transformation nodes that the particulartransformation node subscribes to. As a result, the formula, whichdescribes each check includes by association the formulas of alltransformation nodes in the path that defines the formula for thatcheck. Therefore, the check can be broken down into minimal operations,where each of the operations corresponds to a transformation ruleimplemented in a separate transformation node and arguments for theoperation are implemented in subscriptions to other transformation nodesthat the transformation node established, and where the results of eachoperation are stored in or at each separate transformation node. Thus,for each check, the alerting system does not need to recompute a fullformula for that check every time input events stream(s) change or onschedule. By contrast, traditional alerting systems recompute fullformulas either on every input change or by schedule or on demand, butdo not store and reuse intermediate results of computations to reusethem later.

Each check can be represented as an isolated, directed acyclic graph(DAG). As used herein, a directed acyclic graph is a finite directedgraph with no directed cycles. A DAG consists of many finite verticesand edges, with each edge directed from one vertex to another, such thatthere is no way to start at any vertex and follow aconsistently-directed sequence of edges that eventually loops back tothe vertex again. Equivalently, a DAG is a directed graph that has atopological ordering, a sequence of the vertices such that every edge isdirected from earlier to later in the sequence. No two vertices in thegraph can be connected with more than one edge directly. In accordancewith the disclosed embodiments, vertices of the DAGs have transformationrules assigned to convert incoming states into its own state. Directededges in the DAGs are paths of a state sharing from vertices to othervertices. Any path in the graph starts at an input transformation nodeand ends at an output transformation node.

The disclosed embodiments can improve scalability of an alerting system.The disclosed embodiments also add the notion of reusability of computedresults. That is, checks can be inputs for other checks, if the samecomputed result is needed for several checks they should take it fromthe same source. For example, if several checks share the same pieces oflogic, then these checks can share transformation nodes common to all ofthem so that computation of the shared pieces of logic will be done onlyonce.

The disclosed embodiments can also improve performance of an alertingsystem because the alerting system operates in a “reactive streamingmode.” This means that each transformation node in the alerting systemreacts on incoming events as they arrive and each transformation nodere-computes its state only when one or more external conditions/stateshave changed. In other words, each transformation node in a networkreacts only on significant changes coming from other transformationnode(s) that it subscribes to. Checks are executed independently of eachother so there is no notion of checks cycle. Every transformation nodekeeps its last state, states of its inputs, and re-computes own stateonly when one of its inputs change its state. State computation andstate query processes run independently. Each transformation node doesnot need to be run periodically, but runs only if state changes of othernodes in the network collectively trigger enough state changes totrigger that transformation node to re-evaluate and possibly re-computeits state. If enough state changes occur in succession along aparticular path of nodes this can ultimately change a check result (thatrepresents the state of a check) and trigger an alert, but otherwisenothing happens. As such, the disclosed embodiments can stop computationpropagation if a state of a current transformation node is unchanged,which means that unnecessary computation cycles can be reduced,minimized or eliminated when input event streams are unchanged, and thatnoise will not cause massive recalculations. Accordingly, lesscomputational resources are needed.

In addition, because event streams are directly consumed by the alertsystem, no intermediate storage of events is required, and therefore thedelay between a change in an events stream and a moment when alert iscreated can be reduced.

In one embodiment, an alerting system is provided that includes astreams transformer that includes a network of one or moretransformation nodes. At a minimum, the network includes at least onetransformation node, namely, an input transformation node connecteddirectly to a state change processor, but in most implementationsincludes a plurality of transformation nodes. For example, in oneembodiment, the transformation nodes include a plurality of inputtransformation nodes, a plurality of output transformation nodes, andintermediate nodes that connect particular input and outputtransformation nodes. Each input transformation node is coupled to oneor more of the output transformation nodes by one or more intermediatetransformation nodes. For example, each input transformation nodereceives a particular events stream, but can be coupled or mapped tomany different intermediate and/or output transformation nodes, whereaseach intermediate transformation node can be coupled or mapped to manydifferent input, intermediate and/or output transformation nodes, andeach output transformation node can be coupled or mapped to manydifferent input and/or intermediate transformation nodes. Eachtransformation node (except the input transformation nodes) cansubscribe to one or more transformation nodes, and can receive stateupdates from those transformation nodes that it subscribes to. Forexample, the intermediate transformation nodes and the outputtransformation nodes are both configured to maintain state informationfor each transformation node that they subscribe to. The stateinformation is updated each time a state update is received from anothertransformation node.

Each input transformation node includes an input connector that isconfigured to receive an events stream from a particular eventsproducer. The events stream includes time series of events received fromthe events producer, where each event represents something that hashappened. Each input transformation node has a formula that describes atransformation rule of that input transformation node and informationthat indicates its position within the network. The transformation rulefor that input transformation node can process the events and computestate information for the input transformation node in accordance withthe transformation rule. The transformation rule can then provide stateupdates that indicate the state information for that inputtransformation node to all transformation nodes that subscribe to theinput transformation node. For instance, as one non-limiting example, aparticular input transformation node could have a formula that describes“pass every third value received from events stream A.” This formulaincludes a transformation rule (“pass every third value”) and alsoincludes information that points to the position of the particular inputtransformation node in the network (e.g., node is attached to eventsstream A).

Each time a state update is received from one the transformation nodesthat a particular intermediate transformation node subscribes to, thatparticular intermediate transformation node can evaluate stateinformation for each of the transformation nodes that it subscribes todetermine whether its state information should be updated. When storedstate information for each of the transformation nodes that theparticular intermediate transformation node subscribes to collectivelyindicates that a state update should be generated, that particularintermediate transformation node will determine that its stateinformation should be updated, and can generate a state update that isthen provided to all transformation nodes that subscribe to thatparticular intermediate transformation node.

For example, each intermediate transformation node can include a statemodule for each transformation node that it subscribes to. Each time astate update is received, each state module can store and update stateinformation for each transformation node that it is connected to. In oneembodiment, each state module can include a memory element and a stateupdater. The memory element stores current state information for aparticular transformation node that the particular intermediatetransformation node subscribes to. When the state updater receives astate update from a transformation node, it can compare the new stateinformation (that is indicated in the state update) with the currentstate information stored at the memory element, and can update thecurrent state information stored at the memory element with the newstate information (that is indicated in the state update).

Each intermediate transformation node can include a re-computationtrigger function and a transformation rule. Based on the current stateinformation stored by each of the state modules, the re-computationtrigger function can determine whether state information of theintermediate transformation node is to be updated (e.g., when stateinformation stored by any of the state modules changes), and, if so, cancall the transformation rule to re-compute the state information of theintermediate transformation node in accordance with the transformationrule. The transformation rule can then communicate the re-computed stateinformation to all transformation nodes that subscribe to theintermediate transformation node. The transformation rule is a rule thatdescribes how state information for each transformation node (that theintermediate transformation node subscribes to) is to be transformedinto state information for that intermediate transformation node. Eachtransformation rule can be defined based on one or more operations thatcan be logical operations; mathematical operations; analytic operations;filter-based operations; buffered operations; or any combinationthereof.

The altering system can be used to implement a number of differentchecks. Each check is defined by a path that includes at least an inputtransformation node and a state change processor. Each check can alsoinclude any number of intermediate nodes and an output transformationnode. Each check that is performed produces a check result. When storedstate information for each of the transformation nodes that the outputtransformation node subscribes to collectively indicates that the checkresult should be generated, then that output transformation node cangenerate a check result. Similar to the intermediate transformationnodes, each output transformation node can receive state updates fromany of the transformation nodes that it is subscribed to, and store eachof the state updates as state information.

Similar to the intermediate transformation nodes, each outputtransformation node can include a state module for each transformationnode that the output transformation node subscribes to, a re-computationtrigger function, and a transformation rule. Each state module can storestate information for each transformation node that the outputtransformation node is connected and can update the state informationeach time a state update is received. The re-computation triggerfunction can determine, when state information stored by any of thestate modules changes, whether state information of the outputtransformation node is to be updated based on the current stateinformation stored by each of the state modules. The re-computationtrigger function can call the transformation rule to re-compute thestate information of the output transformation node in accordance withthe transformation rule, and output a check result that corresponds tothe re-computed state information.

Each output transformation node is coupled to a state change processor.Each transformation rule can communicate the check results to itscorresponding state change processor. Each state change processor candetermine whether the check results should trigger an action, and if so,can then perform that action. For example, when a check result isreceived from an output transformation node, each state change processorcan determine (each time a check result is received) whether that checkresult should trigger an action, and then perform the action if it isdetermined that the check result should trigger the action.

In one embodiment, each state change processor includes a state module,an action trigger function, and an action function. The state modulereceives check results from the output transformation node, and storesand updates check results from the output transformation node each timea check result is received. The action trigger function can determinewhether an updated check result provided from the state module shouldtrigger an action, and if so, communicates a trigger command to theaction function. The trigger command causes the action function toperform the action. The action performed by the action function can varydepending on the implementation. For example, the action can be (1)generation and communication of an alert signal or message; (2)generation and communication of command to trigger an action, or (3) anaction triggered from a signal, message or command. For instance, theaction performed by the action function can be an action such as a callto an external service via an application programming interface (API)provided by the external service to take some action.

I. Alerting System Having Stateful Transformation Nodes

FIG. 1 is a block diagram illustrating a computing environment 100according to an embodiment.

The system comprises one or more events producer(s) 110, events storage120, an alerting system 130, a configuration and management module 140,and one or more consumer system(s) 150. The events producer(s) 110 caninclude any number of events producers. An events producer can be anytype of electrical or electronic system, computer-based orsoftware-based system, mechanical system, etc. that generates an eventsstream that needs to be monitored. For instance, in one implementationthe events producers can include a server, server system, or cluster ofservers that are being monitored. Each events stream includes timeseries of events. As used herein, an “event” refers to something thathappened, where the something that happened can be anything. An event isimmutable (or irreversible) and timestamped. An event can refer to atuple (or list of values or elements) which represents something thathappened. In one embodiment, different types of events can includenumeric events and informational events. A numeric event can be a resultof a measurement, and can include information about source of the event,a numeric value and a time stamp. Numeric events can occur on a regularbasis (e.g., once a minute) from different sources. The alerting systemreacts to a numeric event based on a combination of the source and anumeric value. An informational event is non-numeric, and can includeinformation about source of the event and information about somethingthat happened (e.g., textual information about something that happened).Informational events occur irregularly (e.g., are not scheduled to occuron a regular basis). The alerting system reacts to an informationalevent based on a combination of the source and information in the eventabout something that happened.

Event processing refers to methodologies of tracking and analyzingstreams of information (data) about things that happen (events), andderiving a conclusion from them in real-time. Complex event processingrefers to event processing that combines data from multiple sources toinfer events or patterns that suggest more complicated circumstances.The goal of complex event processing is to identify meaningful events(such as opportunities or threats) and respond to them as quickly aspossible.

Storage 120 is optional and can be used to store events received from anumber of events streams. In one embodiment, storage 120 can beimplemented, for example, as a time series database that stores theevents from the different events streams as a time series of events.Time series are finite or infinite sequences of data items, where eachitem has an associated timestamp and the sequence of timestamps isnon-decreasing. Elements of a time series are often called ticks. Thetimestamps are not required to be ascending (merely non-decreasing)because time resolution of some systems such as financial data sourcescan be quite low (milliseconds, microseconds or even nanoseconds), soconsecutive events may carry equal timestamps.

The alerting system 130 monitors the incoming events streams andgenerates actions or alerts that are received by one or more consumersystem(s) 150. The configuration and management module 140 is used toconfigure and manage the alerting system 130. Some of the functions ofthe configuration and management module 140 will be described in greaterdetail below with reference to FIG. 6-12. The consumer system(s) 150 caninclude any number of consumer systems that consume actions or alertsgenerated by the alerting system 130. The consumer system(s) 150 can beany type of electrical or electronic system, computer-based orsoftware-based system, mechanical system, etc. that is either calleddirectly or via an API and reacts in response to actions or alertsgenerated by the alerting system 130. In some implementations, theconsumer system(s) 150 and events producer(s) 110 can overlap and someinstances can be the same entity. For instance, an events producer couldbe a server or server system, and a consumer system could be that serveror another server that is part of the server system.

FIG. 2 is a block diagram illustrating an alerting system 130 accordingto an embodiment. The alerting system 130 includes a streams transformer210 and a plurality of state change processors 260 coupled to thestreams transformer 210. The streams transformer 210 includes a networkof transformation nodes 220, 230, 250 and connections between thosetransformation nodes. In FIG. 2, the transformation nodes arerepresented as circles. The network of transformation nodes can includeinput transformation nodes 220, output transformation nodes 250, and anynumber of intermediate transformation nodes 230 connected between theinput transformation nodes 220 and output transformation nodes 250.

FIG. 3 is a block diagram illustrating a portion 300 of the streamstransformer 210 in FIG. 2 that illustrates some particular intermediatenodes 230-1 . . . 230-6 and the concept of input connectors 310 andoutput connectors 320. As illustrated in FIG. 3, each transformationnode of the streams transformer 210 can include one or more inputconnectors 310 and one or more output connectors 320.

FIG. 4 is a block diagram illustrating components or modules of aparticular transformation node 230-5 of FIG. 2 according to anembodiment. FIG. 4 also illustrates other intermediate transformationnodes 230-1 . . . 230-3 from FIG. 2 that the particular transformationnode 230-5 subscribes to. Although not illustrated in FIG. 4, each ofthe transformation nodes illustrated in FIG. 2 can have the same basiccomponents or modules as transformation node 230-5. The only differenceis that input transformation nodes (not illustrated in FIG. 4) have asingle input connector that receives an events stream and can have oneor more output connectors, whereas intermediate transformation nodes canhave one or more input connectors and one or more output connectors, andoutput transformation nodes (not illustrated in FIG. 4) can have one ormore input connectors and a single output connector that outputs checkresults to a corresponding state change processor 260 (not illustratedin FIG. 4). As such, in the description that follows, only thecomponents or modules of the particular intermediate transformation node230-5 will be described, but it should be appreciated that the basiccomponents or modules of each of the transformation node will be thesame.

Each of the intermediate transformation nodes and output transformationnodes are configured to receive, via one or more input connectors, stateupdates from other transformation nodes that it is subscribed to. Eachof the input transformation nodes can maintain state information for theevents stream that it is coupled to, and each of the intermediatetransformation nodes and output transformation nodes can maintain stateinformation for each transformation node that it subscribes to (andreceives state information from).

For instance, the transformation node 230-5 receives state updates fromtransformation nodes 230-1 . . . 230-3 that it subscribes to, andmaintains state information for each transformation node 230-1 . . .230-3 that it subscribes to (and receives state information from). To doso, the transformation node 230-5 includes a state module 402 for eachtransformation node 230-1 . . . 230-3 that it subscribes to. Each statemodule 402 stores a state for each transformation node it is connectedto. In one embodiment, each state module 402 includes a memory element404 that stores the current state of a transformation node and a stateupdater 406 (e.g., comparator) that updates the memory element 404 eachtime a state update is received from a transformation node 230-1 . . .230-3 that it subscribes to. Thus, each state module 402 can function tokeep the last known state value of each transformation node (using 404)it is coupled to, and compares any new state with the lastknown/recorded value using the state updater 406 whenever a new statevalue comes in. If they are different, the state module 402 raises aflag to notify the re-computation trigger function 408 that state maychange. The re-computation trigger function 408 monitors inputs fromstate modules 402 and when the state modules 402 raise a flag about achange in the incoming state, then the transformation rule 410 may becalled to re-compute a new state value for the state of thattransformation node 230-5, and propagate that state to all nodes thatare subscribed to it. The transformation rule 410 is described ingreater detail below.

Each of the intermediate transformation nodes and output transformationnodes includes logic referred to as a re-computation trigger functionand a transformation rule. For a particular transformation node, thetrigger function determines, based on state information for eachtransformation node that it subscribes to, whether that particulartransformation node should re-compute or update its state. When thetrigger function determines that particular transformation node shouldnot re-compute or update its state, the particular transformation nodedoes nothing and simply maintains its current state. By contrast, whenthe trigger function determines that particular transformation nodeshould re-compute or update its state, the transformation rulere-computes the state for that particular transformation node inaccordance with its defined transformation rule. The particulartransformation node then provides its changed/updated state (via itsoutput connectors) to other transformation nodes that subscribe to thatparticular transformation node. As such, whenever the state of thatparticular transformation node changes, the updated state is provided toall of the other transformation nodes that subscribe to that particulartransformation node.

For instance, the transformation node 230-5 includes a re-computationtrigger function 408 and a transformation rule 410 that is associatedwith that particular transformation node 230-5. Whenever a state updateis received by the transformation node 230-5 from one of thetransformation nodes 230-1 . . . 230-3 that it subscribes to, it updatesthe state at the appropriate state module 402, and sends the currentstate of each state module 402 to the re-computation trigger function408. The trigger function 408 of the transformation node 230-5 evaluatesthe state for each transformation node 230-1 . . . 230-3 to determine,based on state information for each transformation node 230-1 . . .230-3 that it subscribes to, whether it should call the transformationrule 410 to re-compute or update its state. When the trigger function408 determines that it should not re-compute or update state, theparticular transformation node 230-5 does nothing and simply maintainsits current state. By contrast, when the trigger function 408 determinesthat state of the transformation node should be re-computed or updated,it calls the transformation rule 410 to re-compute the state for thatparticular transformation node 230-5 in accordance with its definedtransformation rule. The particular transformation node 230-5 thenprovides its changed/updated state (via its output connectors 420) toother transformation nodes (not illustrated in FIG. 4) that subscribe tothat particular transformation node 230-5. As such, whenever the stateof that particular transformation node 230-5 changes, the updated stateis provided to all of the other transformation nodes that subscribe tothat particular transformation node 230-5.

The “defined transformation rule” is a rule that describes how inputsfor a transformation node are transformed to a state of thattransformation node. For each transformation node the definedtransformation rule can be different and/or unique to thattransformation node. Two transformation nodes are equivalent if theyhave the same inputs and also implement the same defined transformationrule. As will be explained below, equivalent transformation nodes can bede-duplicated by switching all their subscribers to one of theequivalent transformation nodes and removing the other equivalenttransformation nodes. This process helps to reduce computation needsbecause state of the transformation nodes is computed only once.

In one embodiment, the defined transformation rule for eachtransformation node can be defined based on one or more operations. Theoperations used to define a transformation rule can be, for example,logical operations (e.g., AND, OR, XOR, etc.); arithmetic (e.g., sum,average, etc.) or other mathematical operations (e.g., integration,differentiation); analytic operations (e.g., min, max, Nth percentile,etc.); filter-based operations (e.g., >10, between 1 and 3, etc.);buffered operations (e.g., moving average, etc.); or any combination ofthese operations (e.g., “>10 during the last 5 minutes” would be oneexample of a combination of filter-based and buffered operations). Forone type of transformation node, referred to as a frequency reductiontransformation node, the defined transformation rule is a combinedfunction that can be used to align frequencies of different eventstreams. For example, if a stream is too “noisy,” the frequencyreduction transformation node can produce events with a frequency muchhigher than an expected frequency of the rest of the system, and anotherfrequency reduction transformation node attached to the event stream canhelp to downsample it and reduce the noise. For instance, in oneimplementation, downsampling can be implemented as a combination of abuffer operation and an analytic operation (e.g., the 95th percentileover last minute).

While most transformation nodes are subscribed to state updates fromother transformation nodes and compute their state based on a state ofone or more other transformation nodes that the particulartransformation node subscribes to, and also have subscribers for itsstate changes, the input transformation nodes 220 operate differently.Referring again to FIG. 2, each input transformation node 220 differsslightly in that it has a single input connector that is used to receivean events stream from a particular events producer that the particularinput transformation node 220 subscribes to. Each events stream includestime series of events received from an events producer that theparticular input transformation node 220 is subscribed to. Each inputtransformation node 220 processes the events, computes its state inaccordance with its defined transformation rule, and provides its stateupdates to its subscriber transformation nodes.

Each output transformation node 250 has at least one input connector toat least one other transformation node that it subscribes to. Eachoutput transformation node 250 receives state updates from any othertransformation nodes that it is connected to. For a particular outputtransformation node 250, the trigger function determines, based on stateinformation for each transformation node that the particular outputtransformation node 250 subscribes to, whether that particular outputtransformation node 250 should re-compute or update its state. When thetrigger function determines that particular output transformation node250 should not re-compute or update its state, the particular outputtransformation node 250 does nothing and simply maintains its currentstate. By contrast, when the trigger function determines that particularoutput transformation node 250 should re-compute or update its state,the transformation rule re-computes the state for that particular outputtransformation node 250 in accordance with its defined transformationrule, as described above. The particular output transformation node 250then provides its changed/updated state (via its output connector) as a“check result” to a corresponding state change processor 260. In otherwords, whenever the state of that particular output transformation node250 changes, the updated state is output as a check result to acorresponding state change processor 260 (via a single outputconnector). As such, each output transformation node 250 outputs checkresults, where each check result represents a current state of aparticular check. An example of a state change processor 260 will bedescribed below with reference to FIG. 5.

FIG. 5 is a block diagram illustrating a state change processor 260according to an embodiment. FIG. 5 will be described with reference toFIGS. 2-4. Each state change processor 260 has a single input connectorthat is used to receive check results from a particular outputtransformation node 250. Each state change processor 260 includes astate module 510, an action trigger function 516, and an action function518 that performs an action (e.g., generates an alert) in response to astate change.

The state module 510 that includes a memory element 512 that stores thecurrent state of the state change processor 260 and a state updater 514.The state updater 514 processes each check result received from theoutput transformation node 250 and updates the memory element 512 eachtime a new check result is received from the output transformation node250.

The action trigger function 516 receives state changes/updates from thestate module 510, and evaluates the state changes/updates to determinewhether the state change/update should trigger an action.

When the action trigger function 516 determines that the statechange/update should not trigger an action, it does nothing. Bycontrast, when the action trigger function 516 determines that the statechange/update should trigger an action, the action trigger function 516sends a trigger command to the action function 518, and in response theaction function performs an action in response to the trigger command.Thus, when the output of state module 510 raises a flag about a changein the incoming check result, then the action trigger function 516 iscalled to generate an action by the state change processor 260. Theaction can be viewed as part of a formula for a state change processor,where the formula implemented by that state change processorincorporates formulas of all of the transformation nodes that it isconnected to.

The action performed by the action function 518 can be (1) generationand communication of an alert signal or message, or (2) generation andcommunication of command to trigger an action, or (3) an actiontriggered from a signal, message or command.

In one embodiment, an action transforms a state of the state changeprocessor 260 into a call to an external service. As one non-limitingexample, an action can be a call to an external service via anapplication programming interface (API) provided by the service to takesome action. For instance, in one implementation, an action can be acall to a messaging agent or web service to send an alert message.Non-limiting examples of actions can be: “send email to . . . ,” or“send HTTP GET request to URL” Other non-limiting examples of actionscan be a call to an API to take some action, for example, such asturning off a device or changing one of its parameters.

FIG. 6 is a block diagram illustrating an alerting system configurationand management module 600 used to configure and manage an alertingsystem 130 according to an embodiment. The alerting system configurationand management module 600 includes a check definition parser module 620,a transformation nodes discovery service 640, an alerting systemconfiguration module 660, and a balancer module 680.

Storage 610 stores information in a persistent computer-readable storagemedium. For example, storage 610 stores a database of predefined checks.Each check can be represented and stored as a directed acyclic graph(DAG). The check definition parser module 620 transforms human readablecheck definitions into a set of instructions that describe whattransformation nodes should be created, which events stream (e.g., datasources) should be connected to each input transformation node, and howthe transformation nodes of the streams transformer 210 should beinterconnected to implement the check.

Storage 630 stores information in a persistent computer-readable storagemedium. For example, storage 630 stores a list of existingtransformation nodes that are part of the alerting system, and otherinformation about each existing transformation node that is part of thealerting system. For example, this other information for eachtransformation node can include: an identifier (e.g., a hash code) thatcorresponds to a formula for that transformation node, a list of othertransformation nodes that the transformation node subscribes to, a listof other transformation nodes that subscribe to that transformationnode, and any events stream that the transformation node is connectedto, etc. To explain further, each transformation node has a formulaassociated with it. A formula for a particular transformation node is anexpression that describes how the output(s) of other transformationnode(s), that the particular transformation node subscribes to, are tobe processed using a particular transformation rule for that particulartransformation node. As such, the formula for a particulartransformation node takes into account the formulas and transformationrules for all transformation nodes that the particular transformationnode subscribes to. Each identifier can be a number or an alpha-numericsequence that can be used to uniquely identify that formula.

The transformation nodes discovery service 640 determines whethertransformation nodes exist that provide a specific formula. Thetransformation nodes discovery service 640 can determine if anytransformation nodes needed for a new check have already been createdearlier (or already exist) in the alerting system) so thattransformation nodes can be reused. Reuse of existing transformationnodes helps to keep the system demand for resources lower.

The alerting system configuration module 660 creates new transformationnodes and connects them according to a check setup. The alerting systemconfiguration module 660 determines if new inputs should be created whenan absolutely new event arrives. When a check is marked for removal, thealerting system configuration module 660 cleans up the alerting system,for example, by determining which transformation nodes, inputs andconnections belong only to a specific check. The alerting systemconfiguration module 660 removes any transformation nodes that are notconnected to at least one state change processor either directly orindirectly.

Depending on the implementation, an alerting system 130 may be a modulethat is run on a single server or distributed to run on multipleservers. The implementation can depend, for example, on factors such asloading (e.g., number of event streams, transformation nodes and statechange processors), or if there are requirements to run in a highavailability mode in which case the alerting system 130 can be deployedto multiple servers. A group of servers running an implementation of thealerting system 130 form a cluster. Each cluster can be expanded to addnew servers to the group of servers that make up that cluster. This canhappen, for example, when additional computing capacity needs to beadded into the system, or to increase redundancy, or to substitute aserver in the cluster with a new server. Each cluster can also shrink,which means that servers can be removed from the group of servers thatmake up that cluster. This can happen, for example, when the currentload can be handled by fewer servers making it desirable to removeunused servers to save on operational costs, or when a server that ispart of the cluster is broken or requires maintenance. In either case,the server can be removed from the cluster.

The balancer module 680 re-balances checks in a cluster in a response toexpansion or shrinkage of the cluster. To help ensure high availability,the balancer module 680 also keeps checks replicated to survive hardwarefailures to avoid service degradation. For example, in oneimplementation, the balancer module 680 keeps two active copies of allchecks. One copy is an active copy and the other copy is a backup copy.The state change processor 260 of an active copy performs actions onstate changes, while the state change processor 260 of the backup copyonly reacts on state changes by updating state at storage module 512,while its action module 518 is inactive and any actions are skipped.When the active copy becomes unavailable for any reason, configurationmodule 660 changes the state change processor 260 of the backup check toactive, and the state change processor 260 starts performing actions inreaction to state changes. The balancer module 680 provisions a newbackup copy of the under-replicated check on the least loaded server,but on a server different from the server where the active copy runs. Ifthe copy which was active before becomes available again, then thealerting system configuration module 660 either turns it to backup if anew backup copy was not created yet or removes it if the new backup copywas created already.

FIG. 7 is a flow diagram illustrating a system startup method 700performed by the alerting system configuration module 660 including asub-process 750, 760 for adding new checks to the alerting system 130according to an embodiment.

The method 700 begins when the alerting system starts up at 720, and thealerting system configuration module 660 loads checks (or checkdefinitions) from a database of predefined checks that is stored instorage 610. As noted above, each check (or check definition) can bestored as a textual formula. The formula can be converted into adirected acyclic graph (DAG) representation by the Check DefinitionParser 620. The method 700 then continues by adding each new check tothe altering system, as will now be described with reference to 730through 780.

At 730, the alerting system configuration module 660 determines whetherany new checks remain to be added to the alerting system. When thealerting system configuration module 660 determines (at 730) new checksremain to be added to the alerting system, the method 700 proceeds to740.

At 740, the alerting system configuration module 660 loads the next newcheck to be added to the alerting system at the check definition parsermodule 620, which during the first iteration of the loop will be thefirst new check to be added.

At 750, the check definition parser module 620 converts or translatesthe next new check to be added to the alerting system into a set ofactionable instructions that correspond to a DAG. For example, in oneembodiment of 750, the check definition parser module 620 transforms thenew human readable check definition into a set of actionableinstructions for the alerting system configuration module 660. Theseinstructions describe which transformation nodes should be used and/orcreated, which events stream (e.g., data sources) are to be connected toeach input transformation node, and how the transformation nodes areinterconnected to implement the check at the output transformation nodeand what action should be implemented by a new state change processor260.

The method 700 then proceeds to 760, where the alerting systemconfiguration module 660 adds the new check (e.g. DAG) to the alteringsystem. For example, in one embodiment, the alerting systemconfiguration module 660 calls the transformation nodes discoveryservice 640 to find existing transformation nodes including inputtransformation nodes (e.g., FIG. 9) and either creates a subscription toexisting transformation nodes including input transformation nodes ifthe transformation nodes were found or creates new transformation nodes.The alerting system configuration module 660 then creates subscriptionsbetween the newly created transformation nodes including the outputtransformation nodes, and subscriptions to event streams by the inputtransformation nodes. The alerting system configuration module 660 thencreates a state change processor 260 and adds a subscription between thestate change processor 260 and the output transformation node 250.

It should also be noted that while steps 750 and 760 can be performed onstartup of the system, these steps can also be performed any time a newcheck is to be added to the system (e.g., after system startup). When anew check is requested by a user, it can be added to a queue so that itcan be added for implementation. When a check is to be added to thealerting system, the alerting system configuration module 660 can pull acheck from the queue of new checks, and if necessary can create newtransformation nodes, inputs, an output, a state change processor andconnections between transformation nodes to build the check. Once thecheck is built, it can be loaded. Once the check if fully operationaland state of the check is valid, it is considered to be active. As willbe explained below, when a check as no longer needed, it can be markedas decommissioned, and then removed by the alerting system configurationmodule 660.

Referring again to FIG. 7, the method 700 then proceeds to 770, wherethe alerting system configuration module 660 calls the balancer module680 to perform a rebalancing process that will be described furtherbelow with respect to FIG. 12, and the method 700 loops back to 730,where the alerting system configuration module 660 determines whetherany new checks remain to be added to the alerting system. Steps 730through 770 continue to loop until the alerting system configurationmodule 660 determines (at 730) that no new checks remain to be added tothe alerting system, at which point the method 700 proceeds to 780 wherethe method 700 ends.

FIG. 8 is a flow diagram illustrating a method 800 performed by analerting system configuration module 660 for applying a new checkrepresented as a directed acyclic graph (DAG) to an existing systemaccording to an embodiment.

The method 800 begins at 810, where the alerting system configurationmodule 660 receives a check that is represented as a directed acyclicgraph (DAG). The alerting system configuration module 660 traversesthrough the DAG starting from the output transformation node and workingback to input transformation nodes to determine whether subgraph of thedirect acyclic graph already exists in the a database of predefinedchecks (at storage 610).

When the alerting system configuration module 660 determines (at 810)that any part of the received check (that is represented as a DAG)already exists in the database of predefined checks (at storage 610) aspart of an existing check, the method 800 proceeds to 840. At 840, thealerting system configuration module 660 adds a connection to theexisting DAG for the check (i.e., the DAG for that check that alreadyexists in the database of predefined checks at storage 610). The method800 then proceeds to 850, where the alerting system configuration module660 determines whether any elements were taken from the DAG of the newcheck. When the alerting system configuration module 660 determines (at850) that no elements were taken from the original check, the method 800proceeds to 890, where the alerting system configuration module 660creates a new state change processor 260 with an output transformationnode for the new check and adds a subscription to a transformation nodewith the same formula as the new check. When the alerting systemconfiguration module 660 determines (at 850) that one or more elementswere taken from the new check, the method 800 proceeds to 860, where thealerting system configuration module 660 re-connects all elements takenfrom the existing check.

When the alerting system configuration module 660 determines (at 810)that the received check (that is represented as a DAG) or part of itleft from previous steps does not already exist in the database ofpredefined checks as an existing check (at storage 610), the method 800proceeds to 820. At 820, the alerting system configuration module 660takes one element from the existing check (that is represented as a DAG)or from a part of it left from the previous steps, creates a newtransformation node, connects the new transformation node to nodescreated on the previous iterations according to definition of the newcheck (that is represented as a DAG) and returns all elements of the DAGleft after extraction of the one element so that one can be processed onthe next iteration. The method 800 then proceeds to 830, where thealerting system configuration module 660 determines whether anyintermediate transformation nodes are left in the DAG that representsthe received check. When the alerting system configuration module 660determines (at 830) that any elements are left in the DAG (thatrepresents the received check), the method 800 loops back to 810.

When the alerting system configuration module 660 determines (at 830)that no elements are left in the DAG (that represents the receivedcheck), the method 800 proceeds to 860, where the alerting systemconfiguration module 660 re-connects all elements taken from the DAG(that represents the received check). The method 800 then proceeds to870, where the alerting system configuration module 660 determineswhether any new input connectors are required to add the check to thealerting system.

When the alerting system configuration module 660 determines (at 870)that no new input connectors are required, the method 800 proceedsdirectly to 880. By contrast, when the alerting system configurationmodule 660 determines (at 870) that one or more new input connectors arerequired, the method 800 proceeds to 875, where the alerting systemconfiguration module 660 creates the new input connectors that arerequired, and the method 800 proceeds to 880.

At 880, the alerting system configuration module 660 determines whetherany matching subgraphs of the DAG (that represents the received check)were found in the system on one or more of executions of the 810. Whenthe alerting system configuration module 660 determines (at 880) that nomatching subgraphs were found in the DAG (that represents the receivedcheck), the method 800 proceeds directly to 890, where the alertingsystem configuration module 660 creates the new output transformationnode and the new change state processor. By contrast, when the alertingsystem configuration module 660 determines (at 880) that any matchingsubgraphs of the DAG (that represents the received check) were found atone or more executions of the 810, the method 800 proceeds to 885, wherethe alerting system configuration module 660 creates subscriptionsbetween those subgraphs and newly created transformation nodes accordingto the DAG (the represents the received check), and the method 800 thenproceeds to 890, where the alerting system configuration module 660creates a new output transformation node and the new change stateprocessor.

FIG. 9 is a flow diagram illustrating a method 900 performed by atransformation nodes discovery service module 640 for discoveringexisting transformation nodes or creating new transformation nodesaccording to an embodiment. The method 900 begins at 910, where thetransformation nodes discovery service 640 receives an identifier for acurrent transformation node (e.g., a hash code that corresponds to aformula that defines a current transformation node), and searches a listof identifiers for existing transformation nodes stored in storage 630for a matching identifier. The method 900 then proceeds to 930, wherethe transformation nodes discovery service 640 determines whether amatching identifier was found in the list of identifiers for existingtransformation nodes (e.g., an identifier that matches the identifierthat corresponds to a formula that defines the current transformationnode).

When the transformation nodes discovery service 640 determines that amatching identifier was not found in the list of identifiers forexisting transformation nodes, the method 900 proceeds to 940, where thetransformation nodes discovery service 640 returns an indication that nomatching transformation node was found in the list of existingtransformation nodes. In response to this indication, the alertingsystem configuration module 660 can create a new transformation node andadds it to the alerting system 130.

When the transformation nodes discovery service 640 determines that amatching identifier was found in the list of identifiers for existingtransformation nodes, the method 900 proceeds to 950, where thetransformation nodes discovery service 640 returns an indication that amatching transformation node was found in the list of existingtransformation nodes.

FIG. 10 is a flow diagram illustrating a method 1000 for removing anexisting check from the alerting system 130 according to an embodiment.

When an existing check is to be removed, the state change processor 260unsubscribe from the check at 1010. At 1020, the check definition parsermodule 620 translates the check into actionable instructions for thealerting system configuration module 660, and at 1030, the alertingsystem configuration module 660 uses the instructions to find alltransformation nodes involved into the check. For example, the alertingsystem configuration module 660 use a backward inspection along a pathfrom the output transformation node for that check to the inputtransformation node for that check. At 1040, the alerting systemconfiguration module 660 filters out all transformation nodes in thepath that are shared and the removes any unshared transformation nodesalong the path. At 1050, the alerting system configuration module 660calls the balancer module to perform a rebalancing process.

FIG. 11 is a flow diagram illustrating a method 1100 performed by analerting system configuration module 660 when a new event type arrivesaccording to an embodiment. When an event of a new type arrives (newmetric or new kind of other events, but not a new data point) it forms anew events stream. At 1110, the alerting system configuration modulerequests all current subscription definitions for all existing checks.At 1120, the alerting system configuration module 660 compares the newevent type with the definitions to identify all of the checks where anew input connector and input transformation node for the new event typeare added. At 1130, the alerting system configuration module 660 createsthe new input transformation node, and connects it to all of theidentified checks.

FIG. 12 is a flow diagram illustrating a rebalancing method 1200performed by a balancer module 680 according to an embodiment. Thebalancer module 680 can perform the rebalancing method 1200, forexample, when a list of servers in a cluster changes (e.g., increases ordecreases) to keep all servers in a cluster loaded equally. Therebalancing process 1200 begins at 1210, where the balancer module 680computes current load on each server in a cluster. At 1220, the balancermodule 680 identifies moveable checks on any server that is overloaded.If a check or group of checks run on an isolated graph of transformationnodes, then that check or group of checks can be moved from one serverto another server. If a check can be moved it is referred to as“moveable” check. At 1230, the alerting system configuration module 660creates duplicates of any moveable checks on one of the underloadedservers in the cluster (i.e., one of the servers that are not overloadedand have capacity). At 1240, the state change processor 260 makes thenewly created checks active as soon as they are available. At 1250, thealerting system configuration module 660 removes old backup copies ofthe checks from the overloaded servers.

II. Example System Overview

The following description is of one example of a system in which thefeatures described above may be implemented. The components of thesystem described below are merely one example and should not beconstrued as limiting. The features described above with respect toFIGS. 1-12 may be implemented in any other type of computingenvironment, such as one with multiple servers, one with a singleserver, a multi-tenant server environment, a single-tenant serverenvironment, or some combination of the above.

FIG. 13 shows a block diagram of an example of an environment 1310 inwhich an on-demand database service can be used in accordance with someimplementations. The environment 1310 includes user systems 1312, anetwork 1314, a database system 1316 (also referred to herein as a“cloud-based system”), a processor system 1317, an application platform1318, a network interface 1320, tenant database 1322 for storing tenantdata 1323, system database 1324 for storing system data 1325, programcode 1326 for implementing various functions of the system 1316, andprocess space 1328 for executing database system processes andtenant-specific processes, such as running applications as part of anapplication hosting service. In some other implementations, environment1310 may not have all of these components or systems, or may have othercomponents or systems instead of, or in addition to, those listed above.

In some implementations, the environment 1310 is an environment in whichan on-demand database service exists. An on-demand database service,such as that which can be implemented using the system 1316, is aservice that is made available to users outside of the enterprise(s)that own, maintain or provide access to the system 1316. As describedabove, such users generally do not need to be concerned with building ormaintaining the system 1316. Instead, resources provided by the system1316 may be available for such users' use when the users need servicesprovided by the system 1316; that is, on the demand of the users. Someon-demand database services can store information from one or moretenants into tables of a common database image to form a multi-tenantdatabase system (MTS). The term “multi-tenant database system” can referto those systems in which various elements of hardware and software of adatabase system may be shared by one or more customers or tenants. Forexample, a given application server may simultaneously process requestsfor a great number of customers, and a given database table may storerows of data such as feed items for a potentially much greater number ofcustomers. A database image can include one or more database objects. Arelational database management system (RDBMS) or the equivalent canexecute storage and retrieval of information against the databaseobject(s).

Application platform 1318 can be a framework that allows theapplications of system 1316 to execute, such as the hardware or softwareinfrastructure of the system 1316. In some implementations, theapplication platform 1318 enables the creation, management and executionof one or more applications developed by the provider of the on-demanddatabase service, users accessing the on-demand database service viauser systems 1312, or third party application developers accessing theon-demand database service via user systems 1312.

In some implementations, the system 1316 implements a web-based customerrelationship management (CRM) system. For example, in some suchimplementations, the system 1316 includes application servers configuredto implement and execute CRM software applications as well as providerelated data, code, forms, renderable web pages and documents and otherinformation to and from user systems 1312 and to store to, and retrievefrom, a database system related data, objects, and Web page content. Insome MTS implementations, data for multiple tenants may be stored in thesame physical database object in tenant database 1322. In some suchimplementations, tenant data is arranged in the storage medium(s) oftenant database 1322 so that data of one tenant is kept logicallyseparate from that of other tenants so that one tenant does not haveaccess to another tenant's data, unless such data is expressly shared.The system 1316 also implements applications other than, or in additionto, a CRM application. For example, the system 1316 can provide tenantaccess to multiple hosted (standard and custom) applications, includinga CRM application. User (or third party developer) applications, whichmay or may not include CRM, may be supported by the application platform1318. The application platform 1318 manages the creation and storage ofthe applications into one or more database objects and the execution ofthe applications in one or more virtual machines in the process space ofthe system 1316.

According to some implementations, each system 1316 is configured toprovide web pages, forms, applications, data and media content to user(client) systems 1312 to support the access by user systems 1312 astenants of system 1316. As such, system 1316 provides securitymechanisms to keep each tenant's data separate unless the data isshared. If more than one MTS is used, they may be located in closeproximity to one another (for example, in a server farm located in asingle building or campus), or they may be distributed at locationsremote from one another (for example, one or more servers located incity A and one or more servers located in city B). As used herein, eachMTS could include one or more logically or physically connected serversdistributed locally or across one or more geographic locations.Additionally, the term “server” is meant to refer to a computing deviceor system, including processing hardware and process space(s), anassociated storage medium such as a memory device or database, and, insome instances, a database application (for example, OODBMS or RDBMS) asis well known in the art. It should also be understood that “serversystem” and “server” are often used interchangeably herein. Similarly,the database objects described herein can be implemented as part of asingle database, a distributed database, a collection of distributeddatabases, a database with redundant online or offline backups or otherredundancies, etc., and can include a distributed database or storagenetwork and associated processing intelligence.

The network 1314 can be or include any network or combination ofnetworks of systems or devices that communicate with one another. Forexample, the network 1314 can be or include any one or any combinationof a LAN (local area network), WAN (wide area network), telephonenetwork, wireless network, cellular network, point-to-point network,star network, token ring network, hub network, or other appropriateconfiguration. The network 1314 can include a TCP/IP (Transfer ControlProtocol and Internet Protocol) network, such as the global internetworkof networks often referred to as the “Internet” (with a capital “I”).The Internet will be used in many of the examples herein. However, itshould be understood that the networks that the disclosedimplementations can use are not so limited, although TCP/IP is afrequently implemented protocol.

The user systems 1312 can communicate with system 1316 using TCP/IP and,at a higher network level, other common Internet protocols tocommunicate, such as HTTP, FTP, AFS, WAP, etc. In an example where HTTPis used, each user system 1312 can include an HTTP client commonlyreferred to as a “web browser” or simply a “browser” for sending andreceiving HTTP signals to and from an HTTP server of the system 1316.Such an HTTP server can be implemented as the sole network interface1320 between the system 1316 and the network 1314, but other techniquescan be used in addition to or instead of these techniques. In someimplementations, the network interface 1320 between the system 1316 andthe network 1314 includes load sharing functionality, such asround-robin HTTP request distributors to balance loads and distributeincoming HTTP requests evenly over a number of servers. In MTSimplementations, each of the servers can have access to the MTS data;however, other alternative configurations may be used instead.

The user systems 1312 can be implemented as any computing device(s) orother data processing apparatus or systems usable by users to access thedatabase system 1316. For example, any of user systems 1312 can be adesktop computer, a work station, a laptop computer, a tablet computer,a handheld computing device, a mobile cellular phone (for example, a“smartphone”), or any other Wi-Fi-enabled device, wireless accessprotocol (WAP)-enabled device, or other computing device capable ofinterfacing directly or indirectly to the Internet or other network. Theterms “user system” and “computing device” are used interchangeablyherein with one another and with the term “computer.” As describedabove, each user system 1312 typically executes an HTTP client, forexample, a web browsing (or simply “browsing”) program, such as a webbrowser based on the WebKit platform, Microsoft's Internet Explorerbrowser, Netscape's Navigator browser, Opera's browser, Mozilla'sFirefox browser, or a WAP-enabled browser in the case of a cellularphone, PDA or other wireless device, or the like, allowing a user (forexample, a subscriber of on-demand services provided by the system 1316)of the user system 1312 to access, process and view information, pagesand applications available to it from the system 1316 over the network1314.

Each user system 1312 also typically includes one or more user inputdevices, such as a keyboard, a mouse, a trackball, a touch pad, a touchscreen, a pen or stylus or the like, for interacting with a graphicaluser interface (GUI) provided by the browser on a display (for example,a monitor screen, liquid crystal display (LCD), light-emitting diode(LED) display, among other possibilities) of the user system 1312 inconjunction with pages, forms, applications and other informationprovided by the system 1316 or other systems or servers. For example,the user interface device can be used to access data and applicationshosted by system 1316, and to perform searches on stored data, andotherwise allow a user to interact with various GUI pages that may bepresented to a user. As discussed above, implementations are suitablefor use with the Internet, although other networks can be used insteadof or in addition to the Internet, such as an intranet, an extranet, avirtual private network (VPN), a non-TCP/IP based network, any LAN orWAN or the like.

The users of user systems 1312 may differ in their respectivecapacities, and the capacity of a particular user system 1312 can beentirely determined by permissions (permission levels) for the currentuser of such user system. For example, where a salesperson is using aparticular user system 1312 to interact with the system 1316, that usersystem can have the capacities allotted to the salesperson. However,while an administrator is using that user system 1312 to interact withthe system 1316, that user system can have the capacities allotted tothat administrator. Where a hierarchical role model is used, users atone permission level can have access to applications, data, and databaseinformation accessible by a lower permission level user, but may nothave access to certain applications, database information, and dataaccessible by a user at a higher permission level. Thus, different usersgenerally will have different capabilities with regard to accessing andmodifying application and database information, depending on the users'respective security or permission levels (also referred to as“authorizations”).

According to some implementations, each user system 1312 and some or allof its components are operator-configurable using applications, such asa browser, including computer code executed using a central processingunit (CPU) such as an Intel Pentium® processor or the like. Similarly,the system 1316 (and additional instances of an MTS, where more than oneis present) and all of its components can be operator-configurable usingapplication(s) including computer code to run using the processor system1317, which may be implemented to include a CPU, which may include anIntel Pentium® processor or the like, or multiple CPUs.

The system 1316 includes tangible computer-readable media havingnon-transitory instructions stored thereon/in that are executable by orused to program a server or other computing system (or collection ofsuch servers or computing systems) to perform some of the implementationof processes described herein. For example, computer program code 1326can implement instructions for operating and configuring the system 1316to intercommunicate and to process web pages, applications and otherdata and media content as described herein. In some implementations, thecomputer code 1326 can be downloadable and stored on a hard disk, butthe entire program code, or portions thereof, also can be stored in anyother volatile or non-volatile memory medium or device as is well known,such as a ROM or RAM, or provided on any media capable of storingprogram code, such as any type of rotating media including floppy disks,optical discs, digital versatile disks (DVD), compact disks (CD),microdrives, and magneto-optical disks, and magnetic or optical cards,nanosystems (including molecular memory ICs), or any other type ofcomputer-readable medium or device suitable for storing instructions ordata. Additionally, the entire program code, or portions thereof, may betransmitted and downloaded from a software source over a transmissionmedium, for example, over the Internet, or from another server, as iswell known, or transmitted over any other existing network connection asis well known (for example, extranet, VPN, LAN, etc.) using anycommunication medium and protocols (for example, TCP/IP, HTTP, HTTPS,Ethernet, etc.) as are well known. It will also be appreciated thatcomputer code for the disclosed implementations can be realized in anyprogramming language that can be executed on a server or other computingsystem such as, for example, C, C++, HTML, any other markup language,Java™, JavaScript, ActiveX, any other scripting language, such asVBScript, and many other programming languages as are well known may beused. (Java™ is a trademark of Sun Microsystems, Inc.).

FIG. 14 shows a block diagram of example implementations of elements ofFIG. 13 and example interconnections between these elements according tosome implementations. That is, FIG. 14 also illustrates environment1310, but FIG. 14, various elements of the system 1316 and variousinterconnections between such elements are shown with more specificityaccording to some more specific implementations. Elements from FIG. 13that are also shown in FIG. 14 will use the same reference numbers inFIG. 14 as were used in FIG. 13. Additionally, in FIG. 14, the usersystem 1312 includes a processor system 1412A, a memory system 1412B, aninput system 1412C, and an output system 1412D. The processor system1412A can include any suitable combination of one or more processors.The memory system 1412B can include any suitable combination of one ormore memory devices. The input system 1412C can include any suitablecombination of input devices, such as one or more touchscreeninterfaces, keyboards, mice, trackballs, scanners, cameras, orinterfaces to networks. The output system 1412D can include any suitablecombination of output devices, such as one or more display devices,printers, or interfaces to networks.

In FIG. 14, the network interface 1320 of FIG. 13 is implemented as aset of HTTP application servers 14001-1400N. Each application server1400, also referred to herein as an “app server,” is configured tocommunicate with tenant database 1322 and the tenant data 1423 therein,as well as system database 1324 and the system data 1425 therein, toserve requests received from the user systems 1412. The tenant data 1423can be divided into individual tenant storage spaces 1413, which can bephysically or logically arranged or divided. Within each tenant storagespace 1413, tenant data 1414 and application metadata 1416 can similarlybe allocated for each user. For example, a copy of a user's mostrecently used (MRU) items can be stored to user storage 1414. Similarly,a copy of MRU items for an entire organization that is a tenant can bestored to tenant storage space 1413.

The process space 1328 includes system process space 1402, individualtenant process spaces 1404 and a tenant management process space 1410.The application platform 1318 includes an application setup mechanism1438 that supports application developers' creation and management ofapplications. Such applications and others can be saved as metadata intotenant database 1322 by save routines 1436 for execution by subscribersas one or more tenant process spaces 1404 managed by tenant managementprocess 1410, for example. Invocations to such applications can be codedusing PL/SOQL 1434, which provides a programming language styleinterface extension to API 1432. A detailed description of some PL/SOQLlanguage implementations is discussed in commonly assigned U.S. Pat. No.7,730,478, titled METHOD AND SYSTEM FOR ALLOWING ACCESS TO DEVELOPEDAPPLICATIONS VIA A MULTI-TENANT ON-DEMAND DATABASE SERVICE, by CraigWeissman, issued on Jun. 1, 2010, and hereby incorporated by referencein its entirety and for all purposes. Invocations to applications can bedetected by one or more system processes, which manage retrievingapplication metadata 816 for the subscriber making the invocation andexecuting the metadata as an application in a virtual machine.

The system 1316 of FIG. 14 also includes a user interface (UI) 1430 andan application programming interface (API) 1432 to system 1316 residentprocesses to users or developers at user systems 1412. In some otherimplementations, the environment 1310 may not have the same elements asthose listed above or may have other elements instead of, or in additionto, those listed above.

Each application server 1400 can be communicably coupled with tenantdatabase 1322 and system database 1324, for example, having access totenant data 1423 and system data 1425, respectively, via a differentnetwork connection. For example, one application server 14001 can becoupled via the network 1314 (for example, the Internet), anotherapplication server 1400N can be coupled via a direct network link, andanother application server (not illustrated) can be coupled by yet adifferent network connection. Transfer Control Protocol and InternetProtocol (TCP/IP) are examples of typical protocols that can be used forcommunicating between application servers 1400 and the system 1316.However, it will be apparent to one skilled in the art that othertransport protocols can be used to optimize the system 1316 depending onthe network interconnections used.

In some implementations, each application server 1400 is configured tohandle requests for any user associated with any organization that is atenant of the system 1316. Because it can be desirable to be able to addand remove application servers 1400 from the server pool at any time andfor various reasons, in some implementations there is no server affinityfor a user or organization to a specific application server 1400. Insome such implementations, an interface system implementing a loadbalancing function (for example, an F5 Big-IP load balancer) iscommunicably coupled between the application servers 1400 and the usersystems 1412 to distribute requests to the application servers 1400. Inone implementation, the load balancer uses a least-connections algorithmto route user requests to the application servers 1400. Other examplesof load balancing algorithms, such as round robin andobserved-response-time, also can be used. For example, in someinstances, three consecutive requests from the same user could hit threedifferent application servers 1400, and three requests from differentusers could hit the same application server 1400. In this manner, by wayof example, system 1316 can be a multi-tenant system in which system1316 handles storage of, and access to, different objects, data andapplications across disparate users and organizations.

In one example storage use case, one tenant can be a company thatemploys a sales force where each salesperson uses system 1316 to manageaspects of their sales. A user can maintain contact data, leads data,customer follow-up data, performance data, goals and progress data,etc., all applicable to that user's personal sales process (for example,in tenant database 1322). In an example of a MTS arrangement, becauseall of the data and the applications to access, view, modify, report,transmit, calculate, etc., can be maintained and accessed by a usersystem 1412 having little more than network access, the user can managehis or her sales efforts and cycles from any of many different usersystems. For example, when a salesperson is visiting a customer and thecustomer has Internet access in their lobby, the salesperson can obtaincritical updates regarding that customer while waiting for the customerto arrive in the lobby.

While each user's data can be stored separately from other users' dataregardless of the employers of each user, some data can beorganization-wide data shared or accessible by several users or all ofthe users for a given organization that is a tenant. Thus, there can besome data structures managed by system 1316 that are allocated at thetenant level while other data structures can be managed at the userlevel. Because an MTS can support multiple tenants including possiblecompetitors, the MTS can have security protocols that keep data,applications, and application use separate. Also, because many tenantsmay opt for access to an MTS rather than maintain their own system,redundancy, up-time, and backup are additional functions that can beimplemented in the MTS. In addition to user-specific data andtenant-specific data, the system 1316 also can maintain system leveldata usable by multiple tenants or other data. Such system level datacan include industry reports, news, postings, and the like that aresharable among tenants.

In some implementations, the user systems 1412 (which also can be clientsystems) communicate with the application servers 1400 to request andupdate system-level and tenant-level data from the system 1316. Suchrequests and updates can involve sending one or more queries to tenantdatabase 1322 or system database 1324. The system 1316 (for example, anapplication server 1400 in the system 1316) can automatically generateone or more SQL statements (for example, one or more SQL queries)designed to access the desired information. System database 1324 cangenerate query plans to access the requested data from the database. Theterm “query plan” generally refers to one or more operations used toaccess information in a database system.

Each database can generally be viewed as a collection of objects, suchas a set of logical tables, containing data fitted into predefined orcustomizable categories. A “table” is one representation of a dataobject, and may be used herein to simplify the conceptual description ofobjects and custom objects according to some implementations. It shouldbe understood that “table” and “object” may be used interchangeablyherein. Each table generally contains one or more data categorieslogically arranged as columns or fields in a viewable schema. Each rowor element of a table can contain an instance of data for each categorydefined by the fields. For example, a CRM database can include a tablethat describes a customer with fields for basic contact information suchas name, address, phone number, fax number, etc. Another table candescribe a purchase order, including fields for information such ascustomer, product, sale price, date, etc. In some MTS implementations,standard entity tables can be provided for use by all tenants. For CRMdatabase applications, such standard entities can include tables forcase, account, contact, lead, and opportunity data objects, eachcontaining pre-defined fields. As used herein, the term “entity” alsomay be used interchangeably with “object” and “table.”

In some MTS implementations, tenants are allowed to create and storecustom objects, or may be allowed to customize standard entities orobjects, for example by creating custom fields for standard objects,including custom index fields. Commonly assigned U.S. Pat. No.7,779,039, titled CUSTOM ENTITIES AND FIELDS IN A MULTI-TENANT DATABASESYSTEM, by Weissman et al., issued on Aug. 17, 2010, and herebyincorporated by reference in its entirety and for all purposes, teachessystems and methods for creating custom objects as well as customizingstandard objects in a multi-tenant database system. In someimplementations, for example, all custom entity data rows are stored ina single multi-tenant physical table, which may contain multiple logicaltables per organization. It is transparent to customers that theirmultiple “tables” are in fact stored in one large table or that theirdata may be stored in the same table as the data of other customers.

FIG. 15A shows a system diagram illustrating example architecturalcomponents of an on-demand database service environment 1500 accordingto some implementations. A client machine communicably connected withthe cloud 1504, generally referring to one or more networks incombination, as described herein, can communicate with the on-demanddatabase service environment 1500 via one or more edge routers 1508 and1512. A client machine can be any of the examples of user systems 12described above. The edge routers can communicate with one or more coreswitches 1520 and 1524 through a firewall 1516. The core switches cancommunicate with a load balancer 1528, which can distribute server loadover different pods, such as the pods 1540 and 1544. The pods 1540 and1544, which can each include one or more servers or other computingresources, can perform data processing and other operations used toprovide on-demand services. Communication with the pods can be conductedvia pod switches 1532 and 1536. Components of the on-demand databaseservice environment can communicate with database storage 1556 through adatabase firewall 1548 and a database switch 1552.

As shown in FIGS. 15A and 15B, accessing an on-demand database serviceenvironment can involve communications transmitted among a variety ofdifferent hardware or software components. Further, the on-demanddatabase service environment 1500 is a simplified representation of anactual on-demand database service environment. For example, while onlyone or two devices of each type are shown in FIGS. 15A and 15B, someimplementations of an on-demand database service environment can includeanywhere from one to several devices of each type. Also, the on-demanddatabase service environment need not include each device shown in FIGS.15A and 15B, or can include additional devices not shown in FIGS. 15Aand 15B.

Additionally, it should be appreciated that one or more of the devicesin the on-demand database service environment 1500 can be implemented onthe same physical device or on different hardware. Some devices can beimplemented using hardware or a combination of hardware and software.Thus, terms such as “data processing apparatus,” “machine,” “server” and“device” as used herein are not limited to a single hardware device,rather references to these terms can include any suitable combination ofhardware and software configured to provide the described functionality.

The cloud 1504 is intended to refer to a data network or multiple datanetworks, often including the Internet. Client machines communicablyconnected with the cloud 1504 can communicate with other components ofthe on-demand database service environment 1500 to access servicesprovided by the on-demand database service environment. For example,client machines can access the on-demand database service environment toretrieve, store, edit, or process information. In some implementations,the edge routers 1508 and 1512 route packets between the cloud 1504 andother components of the on-demand database service environment 1500. Forexample, the edge routers 1508 and 1512 can employ the Border GatewayProtocol (BGP). The BGP is the core routing protocol of the Internet.The edge routers 1508 and 1512 can maintain a table of IP networks or‘prefixes’, which designate network reachability among autonomoussystems on the Internet.

In some implementations, the firewall 1516 can protect the innercomponents of the on-demand database service environment 1500 fromInternet traffic. The firewall 1516 can block, permit, or deny access tothe inner components of the on-demand database service environment 1500based upon a set of rules and other criteria. The firewall 1516 can actas one or more of a packet filter, an application gateway, a statefulfilter, a proxy server, or any other type of firewall.

In some implementations, the core switches 1520 and 1524 arehigh-capacity switches that transfer packets within the on-demanddatabase service environment 1500. The core switches 1520 and 1524 canbe configured as network bridges that quickly route data betweendifferent components within the on-demand database service environment.In some implementations, the use of two or more core switches 1520 and1524 can provide redundancy or reduced latency.

In some implementations, the pods 1540 and 1544 perform the core dataprocessing and service functions provided by the on-demand databaseservice environment. Each pod can include various types of hardware orsoftware computing resources. An example of the pod architecture isdiscussed in greater detail with reference to FIG. 15B. In someimplementations, communication between the pods 1540 and 1544 isconducted via the pod switches 1532 and 1536. The pod switches 1532 and1536 can facilitate communication between the pods 1540 and 1544 andclient machines communicably connected with the cloud 1504, for examplevia core switches 1520 and 1524. Also, the pod switches 1532 and 1536may facilitate communication between the pods 1540 and 1544 and thedatabase storage 1556. In some implementations, the load balancer 1528can distribute workload between the pods 1540 and 1544. Balancing theon-demand service requests between the pods can assist in improving theuse of resources, increasing throughput, reducing response times, orreducing overhead. The load balancer 1528 may include multilayerswitches to analyze and forward traffic.

In some implementations, access to the database storage 1556 is guardedby a database firewall 1548. The database firewall 1548 can act as acomputer application firewall operating at the database applicationlayer of a protocol stack. The database firewall 1548 can protect thedatabase storage 1556 from application attacks such as structure querylanguage (SQL) injection, database rootkits, and unauthorizedinformation disclosure. In some implementations, the database firewall1548 includes a host using one or more forms of reverse proxy servicesto proxy traffic before passing it to a gateway router. The databasefirewall 1548 can inspect the contents of database traffic and blockcertain content or database requests. The database firewall 1548 canwork on the SQL application level atop the TCP/IP stack, managingapplications' connection to the database or SQL management interfaces aswell as intercepting and enforcing packets traveling to or from adatabase network or application interface.

In some implementations, communication with the database storage 1556 isconducted via the database switch 1552. The multi-tenant databasestorage 1556 can include more than one hardware or software componentsfor handling database queries. Accordingly, the database switch 1552 candirect database queries transmitted by other components of the on-demanddatabase service environment (for example, the pods 1540 and 1544) tothe correct components within the database storage 1556. In someimplementations, the database storage 1556 is an on-demand databasesystem shared by many different organizations as described above withreference to FIG. 13 and FIG. 14.

15 FIG. 15B shows a system diagram further illustrating examplearchitectural components of an on-demand database service environmentaccording to some implementations. The pod 1544 can be used to renderservices to a user of the on-demand database service environment 1500.In some implementations, each pod includes a variety of servers or othersystems. The pod 1544 includes one or more content batch servers 1564,content search servers 1568, query servers 1582, file force servers1586, access control system (ACS) servers 1580, batch servers 1584, andapp servers 1588. The pod 1544 also can include database instances 1590,quick file systems (QFS) 1592, and indexers 1594. In someimplementations, some or all communication between the servers in thepod 1544 can be transmitted via the switch 1536.

In some implementations, the app servers 1588 include a hardware orsoftware framework dedicated to the execution of procedures (forexample, programs, routines, scripts) for supporting the construction ofapplications provided by the on-demand database service environment 1500via the pod 1544. In some implementations, the hardware or softwareframework of an app server 1588 is configured to execute operations ofthe services described herein, including performance of the blocks ofvarious methods or processes described herein. In some alternativeimplementations, two or more app servers 1588 can be included andcooperate to perform such methods, or one or more other serversdescribed herein can be configured to perform the disclosed methods.

The content batch servers 1564 can handle requests internal to the pod.Some such requests can be long-running or not tied to a particularcustomer. For example, the content batch servers 1564 can handlerequests related to log mining, cleanup work, and maintenance tasks. Thecontent search servers 1568 can provide query and indexer functions. Forexample, the functions provided by the content search servers 1568 canallow users to search through content stored in the on-demand databaseservice environment. The file force servers 1586 can manage requests forinformation stored in the File force storage 1598. The File forcestorage 1598 can store information such as documents, images, and basiclarge objects (BLOB s). By managing requests for information using thefile force servers 1586, the image footprint on the database can bereduced. The query servers 1582 can be used to retrieve information fromone or more file storage systems. For example, the query system 1582 canreceive requests for information from the app servers 1588 and transmitinformation queries to the NFS 1596 located outside the pod.

The pod 1544 can share a database instance 1590 configured as amulti-tenant environment in which different organizations share accessto the same database. Additionally, services rendered by the pod 1544may call upon various hardware or software resources. In someimplementations, the ACS servers 1580 control access to data, hardwareresources, or software resources. In some implementations, the batchservers 1584 process batch jobs, which are used to run tasks atspecified times. For example, the batch servers 1584 can transmitinstructions to other servers, such as the app servers 1588, to triggerthe batch jobs.

In some implementations, the QFS 1592 is an open source file storagesystem available from Sun Microsystems® of Santa Clara, Calif. The QFScan serve as a rapid-access file storage system for storing andaccessing information available within the pod 1544. The QFS 1592 cansupport some volume management capabilities, allowing many disks to begrouped together into a file storage system. File storage systemmetadata can be kept on a separate set of disks, which can be useful forstreaming applications where long disk seeks cannot be tolerated. Thus,the QFS system can communicate with one or more content search servers1568 or indexers 1594 to identify, retrieve, move, or update data storedin the network file storage systems 1596 or other storage systems.

In some implementations, one or more query servers 1582 communicate withthe NFS 1596 to retrieve or update information stored outside of the pod1544. The NFS 1596 can allow servers located in the pod 1544 to accessinformation to access files over a network in a manner similar to howlocal storage is accessed. In some implementations, queries from thequery servers 1582 are transmitted to the NFS 1596 via the load balancer1528, which can distribute resource requests over various resourcesavailable in the on-demand database service environment. The NFS 1596also can communicate with the QFS 1592 to update the information storedon the NFS 1596 or to provide information to the QFS 1592 for use byservers located within the pod 1544.

In some implementations, the pod includes one or more database instances1590. The database instance 1590 can transmit information to the QFS1592. When information is transmitted to the QFS, it can be availablefor use by servers within the pod 1544 without using an additionaldatabase call. In some implementations, database information istransmitted to the indexer 1594. Indexer 1594 can provide an index ofinformation available in the database 1590 or QFS 1592. The indexinformation can be provided to file force servers 1586 or the QFS 1592.

FIG. 16 illustrates a diagrammatic representation of a machine in theexemplary form of a computer system 1600 within which a set ofinstructions, for causing the machine to perform any one or more of themethodologies discussed herein, may be executed. The system 1600 may bein the form of a computer system within which a set of instructions, forcausing the machine to perform any one or more of the methodologiesdiscussed herein, may be executed. In alternative embodiments, themachine may be connected (e.g., networked) to other machines in a LAN,an intranet, an extranet, or the Internet. The machine may operate inthe capacity of a server machine in client-server network environment.The machine may be a personal computer (PC), a set-top box (STB), aserver, a network router, switch or bridge, or any machine capable ofexecuting a set of instructions (sequential or otherwise) that specifyactions to be taken by that machine. Further, while only a singlemachine is illustrated, the term “machine” shall also be taken toinclude any collection of machines that individually or jointly executea set (or multiple sets) of instructions to perform any one or more ofthe methodologies discussed herein. In one embodiment, computer system1600 may represent application server 110, as shown in FIGS. 2-4 and 6.

The exemplary computer system 1600 includes a processing device(processor) 1602, a main memory 1604 (e.g., read-only memory (ROM),flash memory, dynamic random access memory (DRAM) such as synchronousDRAM (SDRAM)), a static memory 1606 (e.g., flash memory, static randomaccess memory (SRAM)), and a data storage device 1618, which communicatewith each other via a bus 1630.

Processing device 1602 represents one or more general-purpose processingdevices such as a microprocessor, central processing unit, or the like.More particularly, the processing device 1602 may be a complexinstruction set computing (CISC) microprocessor, reduced instruction setcomputing (RISC) microprocessor, very long instruction word (VLIW)microprocessor, or a processor implementing other instruction sets orprocessors implementing a combination of instruction sets. Theprocessing device 1602 may also be one or more special-purposeprocessing devices such as an application specific integrated circuit(ASIC), a field programmable gate array (FPGA), a digital signalprocessor (DSP), network processor, or the like.

The computer system 1600 may further include a network interface device1608. The computer system 1600 also may include a video display unit1610 (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)),an alphanumeric input device 1612 (e.g., a keyboard), a cursor controldevice 1614 (e.g., a mouse), and a signal generation device 1616 (e.g.,a speaker).

The data storage device 1618 may include a computer-readable medium 1628on which is stored one or more sets of instructions 1622 (e.g.,instructions of in-memory buffer service 114) embodying any one or moreof the methodologies or functions described herein. The instructions1622 may also reside, completely or at least partially, within the mainmemory 1604 and/or within processing logic 1626 of the processing device1602 during execution thereof by the computer system 1600, the mainmemory 1604 and the processing device 1602 also constitutingcomputer-readable media. The instructions may further be transmitted orreceived over a network 1620 via the network interface device 1608.

While the computer-readable storage medium 1628 is shown in an exemplaryembodiment to be a single medium, the term “computer-readable storagemedium” should be taken to include a single medium or multiple media(e.g., a centralized or distributed database, and/or associated cachesand servers) that store the one or more sets of instructions. The term“computer-readable storage medium” shall also be taken to include anymedium that is capable of storing, encoding or carrying a set ofinstructions for execution by the machine and that cause the machine toperform any one or more of the methodologies of the present invention.The term “computer-readable storage medium” shall accordingly be takento include, but not be limited to, solid-state memories, optical media,and magnetic media.

The preceding description sets forth numerous specific details such asexamples of specific systems, components, methods, and so forth, inorder to provide a good understanding of several embodiments of thepresent invention. It will be apparent to one skilled in the art,however, that at least some embodiments of the present invention may bepracticed without these specific details. In other instances, well-knowncomponents or methods are not described in detail or are presented insimple block diagram format in order to avoid unnecessarily obscuringthe present invention. Thus, the specific details set forth are merelyexemplary. Particular implementations may vary from these exemplarydetails and still be contemplated to be within the scope of the presentinvention.

In the above description, numerous details are set forth. It will beapparent, however, to one of ordinary skill in the art having thebenefit of this disclosure, that embodiments of the invention may bepracticed without these specific details. In some instances, well-knownstructures and devices are shown in block diagram form, rather than indetail, in order to avoid obscuring the description.

Some portions of the detailed description are presented in terms ofalgorithms and symbolic representations of operations on data bitswithin a computer memory. These algorithmic descriptions andrepresentations are the means used by those skilled in the dataprocessing arts to most effectively convey the substance of their workto others skilled in the art. An algorithm is here, and generally,conceived to be a self-consistent sequence of steps leading to a desiredresult. The steps are those requiring physical manipulations of physicalquantities. Usually, though not necessarily, these quantities take theform of electrical or magnetic signals capable of being stored,transferred, combined, compared, and otherwise manipulated. It hasproven convenient at times, principally for reasons of common usage, torefer to these signals as bits, values, elements, symbols, characters,terms, numbers, or the like.

It should be borne in mind, however, that all of these and similar termsare to be associated with the appropriate physical quantities and aremerely convenient labels applied to these quantities. Unlessspecifically stated otherwise as apparent from the above discussion, itis appreciated that throughout the description, discussions utilizingterms such as “determining”, “identifying”, “adding”, “selecting” or thelike, refer to the actions and processes of a computer system, orsimilar electronic computing device, that manipulates and transformsdata represented as physical (e.g., electronic) quantities within thecomputer system's registers and memories into other data similarlyrepresented as physical quantities within the computer system memoriesor registers or other such information storage, transmission or displaydevices.

Embodiments of the invention also relate to an apparatus for performingthe operations herein. This apparatus may be specially constructed forthe required purposes, or it may comprise a general purpose computerselectively activated or reconfigured by a computer program stored inthe computer. Such a computer program may be stored in a computerreadable storage medium, such as, but not limited to, any type of diskincluding floppy disks, optical disks, CD-ROMs, and magnetic-opticaldisks, read-only memories (ROMs), random access memories (RAMs), EPROMs,EEPROMs, magnetic or optical cards, or any type of media suitable forstoring electronic instructions.

The algorithms and displays presented herein are not inherently relatedto any particular computer or other apparatus. Various general purposesystems may be used with programs in accordance with the teachingsherein, or it may prove convenient to construct a more specializedapparatus to perform the required method steps. The required structurefor a variety of these systems will appear from the description below.In addition, the present invention is not described with reference toany particular programming language. It will be appreciated that avariety of programming languages may be used to implement the teachingsof the invention as described herein.

It is to be understood that the above description is intended to beillustrative, and not restrictive. Many other embodiments will beapparent to those of skill in the art upon reading and understanding theabove description. The scope of the invention should, therefore, bedetermined with reference to the appended claims, along with the fullscope of equivalents to which such claims are entitled.

What is claimed:
 1. An alerting system that is configured to run on aserver system comprising processing hardware, the alerting systemcomprising: a streams transformer comprising: a network oftransformation nodes comprising: an input transformation node configuredto receive events generated by an events producer as part of an eventsstream, process the events to generate state updated that indicatesstate information, and communicate the state information to alltransformation nodes that subscribe to the input transformation node; anoutput transformation node; and at least one intermediate transformationnode coupled between the input transformation node and the outputtransformation node, wherein each of the intermediate transformationnodes comprise for each particular transformation node that theintermediate transformation node subscribes to: a state module beingconfigured to store current state information for a particulartransformation node that the intermediate transformation node subscribesto; and a state updater being configured to update the current stateinformation indicated in a state update for a particular transformationnode that the intermediate transformation node subscribes to with newstate information, wherein the output transformation node is configuredto: generate a check result when stored state information for each ofthe transformation nodes that the output transformation node subscribesto collectively indicates that the check result should be generated; anda state change processor configured to: perform an action when it isdetermined that the check result is to trigger the action, wherein theaction causes a consumer system to react to the action.
 2. The system ofclaim 1, wherein the intermediate transformation node subscribes to atleast the input transformation node and is configured to receive stateupdates from at least the input transformation node, and wherein theoutput transformation node subscribes to at least the intermediatetransformation node and is configured to receive state updates from atleast the intermediate transformation node.
 3. The system of claim 2,wherein the input transformation node comprises: an input connector thatis configured to receive the events stream from the events producer thatthe input transformation node subscribes to, wherein the events streamincludes time series of events received from the events producer,wherein each event represents something that has happened; and atransformation rule, for that input transformation node, that isconfigured to: process the events and compute state information for theinput transformation node in accordance with the transformation rule,and provide state updates that indicate the state information to alltransformation nodes that subscribe to the input transformation node. 4.The system of claim 1, wherein the intermediate transformation node andthe output transformation node are both configured to maintain stateinformation for each transformation node that they subscribe to, whereinthe state information is updated each time a state update is receivedfrom another transformation node.
 5. The system of claim 4, wherein theintermediate transformation node is further configured to: determinewhether state information for that intermediate transformation nodeshould be updated based on state information for each of thetransformation nodes that the intermediate transformation nodesubscribes to each time a state update is received from at least one ofthe transformation nodes that the intermediate transformation nodesubscribes to, and generate a state update when stored state informationfor each of the transformation nodes that the intermediatetransformation node subscribes to collectively indicates that the stateupdate should be generated, and wherein the output transformation nodeis further configured to: receive state updates from any of thetransformation nodes the output transformation node is subscribed to,and store each of the state updates as state information.
 6. The systemof claim 1, wherein each state module of each of the intermediatetransformation nodes is configured to: receive state updates from any ofthe transformation nodes that the intermediate transformation node issubscribed to; store each of the state updates as state information; andupdate state information for each transformation node that theintermediate transformation node is connected to each time a stateupdate is received from another transformation node that theintermediate transformation node is connected to.
 7. The system of claim6, wherein the state updater of each state module of each of theintermediate transformation nodes comprises: a memory element thatstores current state information for a particular transformation nodethat the intermediate transformation node subscribes to, and wherein thestate updater of each state module of each of the intermediatetransformation nodes is configured to: receive state updates from theparticular transformation node; compare, each time a state update isreceived, new state information that is indicated in the state updatewith the current state information stored at the memory element; andupdate the current state information that is stored at the memoryelement with the new state information that is indicated in the stateupdate.
 8. The system of claim 6, wherein each intermediatetransformation node further comprises: a transformation rule for thatintermediate transformation node; and a re-computation trigger functionfor that intermediate transformation node that is configured to:determine, based on current state information stored by each of thestate modules for each of the transformation nodes that the intermediatetransformation node subscribes to, whether state information for thatintermediate transformation node is to be updated only when stateinformation stored by any of the state modules changes each time a stateupdate is received from at least one of the transformation nodes thatthe intermediate transformation node subscribes to; and call thetransformation rule to re-compute the state information for thatintermediate transformation node in accordance with the transformationrule, wherein the transformation rule is configured to communicate astate update comprising the re-computed state information to alltransformation nodes that subscribe to the intermediate transformationnode.
 9. The system of claim 8, wherein the transformation rule is arule that describes how state information for each transformation nodethat the intermediate transformation node subscribes to is to betransformed into state information for the intermediate transformationnode.
 10. The system of claim 8, wherein the transformation rule of theintermediate transformation node is defined based on one or moreoperations.
 11. The system of claim 10, wherein the one or moreoperations that define the transformation rule of the intermediatetransformation node comprise at least one of: logical operations;mathematical operations; analytic operations; filter-based operations;buffered operations; or any combination thereof.
 12. The system of claim1, wherein the output transformation node, comprises: a state module foreach transformation node that the output transformation node subscribesto, wherein each state module is configured to: receive state updatesfrom any of the transformation nodes the output transformation node issubscribed to; store each of the state updates as state information; andupdate state information for each transformation node that the outputtransformation node is connected to each time a state update is receivedfrom another transformation node that the output transformation node isconnected to; a transformation rule; and a re-computation triggerfunction that is configured to: determine, based on the current stateinformation stored by each of the state modules when state informationstored by any of the state modules changes, whether state information ofthe output transformation node is to be updated; and call thetransformation rule to: re-compute the state information of the outputtransformation node in accordance with the transformation rule of theoutput transformation node, and output a check result that correspondsto the re-computed state information, wherein the transformation rule isconfigured to communicate the check result to the state change processorwhen the stored state information for each of the transformation nodesthat the output transformation node subscribes to collectively indicatesthat the check result should be generated, wherein the state changeprocessor is further configured to: receive the check results from theoutput transformation node; determine, each time a check result isreceived, whether that check result should trigger an action; and thenperform the action when it is determined that the check result shouldtrigger the action.
 13. The system of claim 1, wherein the state changeprocessor comprises: a state module that is configured to receive thecheck result from the transformation rule of the output transformationnode; and to store and update check results from the outputtransformation node each time a check result is received; an actiontrigger function configured to: determine whether the check result orthe updated check results provided from the state module should triggeran action; and communicate a trigger command when it determines that thecheck result or the updated check results should trigger the action; andan action function that performs the action in response to the triggercommand.
 14. The system of claim 13, wherein the action performed by theaction function comprises: (1) generation and communication of an alertsignal or message; (2) generation and communication of command totrigger an action; (3) an action triggered from a signal, message orcommand; or (4) a call to an application programming interface (API).15. The system of claim 1, wherein a path that includes the inputtransformation node, the intermediate transformation node and the outputtransformation node defines a check performed that produces the checkresult.
 16. An alerting system that is configured to run on a serversystem comprising processing hardware, the alerting system comprising: astreams transformer comprising: a network of transformation nodescomprising: a plurality of input transformation nodes each beingconfigured to receive an events stream generated by an events producer,process the events to generate state updated that indicates stateinformation, and communicate the state information to all transformationnodes that subscribe to the input transformation node; a plurality ofoutput transformation nodes; and a plurality of intermediatetransformation nodes coupled between the input transformation nodes andthe output transformation nodes, wherein each of the intermediatetransformation nodes and output transformation nodes subscribe to andreceive state updates from one or more of the transformation nodes thatare part of the network, wherein each of the intermediate transformationnodes comprise for each particular transformation node that theintermediate transformation node subscribes to: a state module beingconfigured to store current state information for a particulartransformation node that the intermediate transformation node subscribesto; and a state updater being configured to update the current stateinformation indicated in a state update for a particular transformationnode that the intermediate transformation node subscribes to with newstate information, wherein each of the output transformation nodes isconfigured to: generate a check result when the stored state informationfor each of the transformation nodes that the output transformation nodesubscribes to collectively indicates that the check result should begenerated; and a plurality of state change processors each beingconfigured to: perform an action when that state change processordetermines, based on a check result received from a corresponding outputtransformation node, that the check result is to trigger the action,wherein the action causes a consumer system to react to the action. 17.The system of claim 16, wherein the network of transformation nodescomprises a plurality of different paths, wherein each path comprises: aparticular input transformation node, one or more of the intermediatetransformation nodes and a particular output transformation node,wherein each path defines a check performed that produces a checkresult.
 18. The system of claim 16, wherein each the inputtransformation node comprises: a transformation rule that is configuredto: compute state information, based on events received in an eventsstream from the events producer, and provide state updates that indicatethe state information to all transformation nodes that subscribe to thatinput transformation node, and wherein each of the intermediatetransformation nodes and the output transformation nodes are configuredto: store and update state information for each transformation node thatthey subscribe to, wherein the state information is updated each time astate update is received from one of the transformation nodes that theysubscribe to; receive state updates from any of the transformation nodesthat each is subscribed to, store each of the state updates as stateinformation; and determine whether state information for thatintermediate transformation node or a check result for that outputtransformation node should be updated based on state information foreach of the transformation nodes that the intermediate transformationnode or output transformation node subscribes to, respectively.
 19. Thesystem of claim 18, wherein each intermediate transformation nodecomprises: a state module for each transformation node that theintermediate transformation node subscribes to, wherein each statemodule is configured to: receive state updates from any of thetransformation nodes that the intermediate transformation node issubscribed to; store each of the state updates as state information; andupdate state information for each transformation node that theintermediate transformation node is connected to each time a stateupdate is received from another transformation node that theintermediate transformation node is connected to; a transformation rulefor that intermediate transformation node; and a re-computation triggerfunction for that intermediate transformation node that is configuredto: determine, based on current state information stored by each of thestate modules for each of the transformation nodes that the intermediatetransformation node subscribes to, whether state information for thatintermediate transformation node is to be updated only when stateinformation stored by any of the state modules changes each time a stateupdate is received from at least one of the transformation nodes thatthe intermediate transformation node subscribes to; and call thetransformation rule to re-compute the state information for thatintermediate transformation node in accordance with the transformationrule, wherein the transformation rule re-computes the state informationwhen current state information, stored at that intermediatetransformation node for transformation nodes that the intermediatetransformation node subscribes to, indicates that state information ofthat intermediate transformation node is to be updated, wherein thetransformation rule is configured to communicate a state updatecomprising the re-computed state information to all transformation nodesthat subscribe to the intermediate transformation node, wherein theoutput transformation node, comprises: a transformation rule configuredto: re-compute state information of that intermediate transformationnode in accordance with the transformation rule of that outputtransformation node, wherein the transformation rule re-computes thestate information when current state information, stored at thatintermediate transformation node for transformation nodes that theintermediate transformation node subscribes to, indicates that stateinformation of that intermediate transformation node is to be updated;and communicate a check result to a corresponding state changeprocessor, wherein the check result comprises the re-computed stateinformation.
 20. In an alerting system comprising at least one inputtransformation node that is configured to receive an events stream ofevents generated by an events producer, an output transformation node,and a plurality of intermediate transformation nodes coupled between theinput transformation node and the output transformation node, whereineach of the intermediate transformation nodes comprise for eachparticular transformation node that the intermediate transformation nodesubscribes to: a state module and a state updater, a method performed bythe alerting system, the method comprising: processing the events at theinput transformation node the events to generate state updates thatindicates state information; communicating the state information fromthe input transformation node to all transformation nodes that subscribeto the input transformation node; at each state module of one of theintermediate transformation nodes: storing current state information fora particular transformation node that the intermediate transformationnode subscribes to; at each state updater of one of the intermediatetransformation nodes: updating the current state information indicatedin a state update for a particular transformation node that theintermediate transformation node subscribes to with new stateinformation; at the output transformation node: generating a checkresult when stored state information for each of the transformationnodes that the output transformation node subscribes to collectivelyindicates that the check result should be generated; and at a statechange processor: performing an action when it is determined that thecheck result is to trigger the action, wherein the action causes aconsumer system to react to the action.